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ABSTRACT 

Usage of network resources on a communications network is controlled by creating one 
or more packet rules for analyzing packets received at one or more devices of the 
communications network, each rule including a condition and action to be taken if a packet 
5 received at a device satisfies the condition, and creating one or more service abstractions, each 
service abstraction representing a named set of one or more of the packet rules. Further, one or 
more role abstractions may be created, each role abstraction representing a role of a user with 
respect to the communications network, and each role abstraction including a set of one more 
packet rules, and possibly one or more service abstractions. These role abstractions and service 

1 0 abstractions may be stored and distributed to network devices on the communications network. 
Role abstractions and service abstractions ease the configuration, implementation, and 
administration of packet rules and network policy by enabling the reuse, storage, and 

i modification of an aggregation of one or more packet rules. Instead of configuring each existing 
or new device in a network individually, roles and service abstractions can be used to 

*1 5 simultaneously configure a number of devices, regardless of location in the network. Role 

l abstractions and service abstractions allow a network administrator to aggregate complex 

technological configuration parameters providing translation between the languages of technical 

J and non-technical members of an organization. 
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